Virtualization-based Penetration Testing Study for Detecting Accessibility Abuse Vulnerabilities in Banking Apps in East and Southeast Asia

arXiv:2601.21258 · cs.CR, cs.SE · Submitted 2026-01-29 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: Today's paper: "Virtualization-based Penetration Testing Study for Detecting Accessibility Abuse Vulnerabilities in Banking Apps in East and Southeast Asia".

Elias: The gist: This study conducts an empirical penetration testing of banking and finance applications in East and Southeast Asia to evaluate their susceptibility to FjordPhantom,

Nadia: First, who's behind it and why it matters.

Paper summary: Nadia: So, wrapping up this look at the "Virtualization-based Penetration Testing Study for Detecting Accessibility Abuse Vulnerabilities in Banking Apps in East and Southeast Asia", the authors are pointing out a few key things about where we stand right now.

Elias: They're essentially showing that over two hundred twenty-five million Android users in East and Southeast Asia could potentially be subject to FjordPhantom, which really highlights the need for much stronger security practices in mobile banking applications across that area.

Priya: What this study means for someone just listening is that it shows how developers can use penetration testing and hardening measures to bridge the gap between what attackers are doing and what the apps are actually protected against.

Nadia: The paper emphasizes applying concepts like hardening measures directly in a practical way to stop attacks, which is important for moving security from theoretical ideas to real application.

Elias: It’s about understanding how this malware works at a low level—using virtualization and hooking—so developers can build defenses that specifically counter those mechanisms.

Priya: The implication here is that we need more focused research on the implementation details of those hardening measures and remote attestation solutions to see if they actually hold up against these kinds of accessibility abuse attacks.

Conclusion: Nadia: So, we've looked at how FjordPhantom uses virtualization to sneak past security checks in banking apps across East and Southeast Asia, right?

Elias: Yeah, that's a lot of layering there with the virtualization and hooking stuff.

Priya: And what this study really boils down to is mapping out exactly where these vulnerabilities are most common geographically.

Nadia: It shows that many of those banking apps have serious holes because they aren't checking for these accessibility service bypasses properly.

Elias: The authors found a huge vulnerability rate, around forty-three percent across all the apps they tested in that region.

Priya: But the numbers vary wildly; Singapore is hit way harder, at seventy-five percent vulnerability there compared to Japan or Korea.

Nadia: That variation tells us that the security hardening isn't uniform across those different countries.

Elias: And what they found was that anti-VM stuff is definitely the most common thing developers are doing to stop this kind of attack.

Priya: It's interesting because seventy-eight percent of apps with anti-disassembly measures were actually resistant, even when FjordPhantom didn't need to change the code itself.

Nadia: That suggests some existing protections are doing a decent job at stopping this specific type of evasion technique.

Elias: But it also shows that developers have to be very careful because attackers keep finding new ways around those defenses.

Priya: So, looking at the whole picture, this paper highlights that we need more than just one fix; we need a better system for checking these app protections overall.

Singapore Management University · MIE-SPPU Institute of Higher Education, Qatar

cs.CR, cs.SE

Submitted: 2026-01-29

Updated: 2026-01-29

Comments: Accepted at APSEC 2025 Software Engineering in Practices (SEIP)

DOI: 10.1109/APSEC66846.2025.00111

Code: https://github.com/rednaga/APKiD

License: http://creativecommons.org/licenses/by/4.0/

Importance score: 74/100

The gist: The gist: This study conducts an empirical penetration testing of banking and finance applications in East and Southeast Asia to evaluate their susceptibility to FjordPhantom, a malware that uses

Key concepts

FjordPhantom: This is a specific piece of malware that targets banking and finance apps in East and Southeast Asia. It uses advanced techniques like virtualization and hooking to trick security systems into ignoring its malicious activities, allowing it to steal data.
Virtualization-based Attack: FjordPhantom employs virtualization to create a deceptive environment for the banking app. This technique allows the malware to run in a way that bypasses standard detection methods designed to spot malicious accessibility services, enabling actions like keylogging and screen scraping.
Accessibility Service Detection: This refers to the security mechanisms apps use on Android devices to monitor and block unauthorized access by other applications. FjordPhantom specifically targets these checks, using virtualization to hide its presence from these monitoring systems.

Terminology

Google Play Protect — 6× in this paper
Provenance — 1× in this paper · explained in 5 episodes
Runtime Application Self-Protection — 1× in this paper

Summary

The gist: This study conducts an empirical penetration testing of banking and finance applications in East and Southeast Asia to evaluate their susceptibility to FjordPhantom, a malware that uses virtualization to bypass accessibility service detection, revealing significant vulnerabilities across the region.

FjordPhantom Attack Mechanism

FjordPhantom utilizes virtualization and hooking techniques to evade detection mechanisms designed to flag malicious accessibility services. The attack operates in two main stages where the first involves deceiving users into installing an app that seems benign and activating a malicious accessibility service. The second stage allows FjordPhantom to perform malicious activities such as keylogging, screen scraping, or other forms of unauthorized access to the app’s data by exploiting the disabled detection.

Penetration Testing Setup and Scope

The researchers selected banking apps from seven countries in East and Southeast Asia, totaling 83 apps with collective downloads exceeding 405 million. The penetration testing system involved an automated flow where the target app was downloaded from Google Play, extracted using ADB, and then repackaged to perform the virtualization-based attack. To ensure ethical compliance, the scope was strictly limited to local device only and involved only a rudimentary disabling of accessibility service detection in the apps.

Vulnerability Distribution and Hardening Measures

The study found that 43.37% (36 out of 83) of the banking apps across the seven Asian countries are vulnerable to FjordPhantom attacks. Vulnerability rates varied by country, with Singapore showing a high rate of 75% vulnerability, while Japan and Korea had lower rates at 15.38% and 12.50%, respectively. Analysis of protection measures showed that anti-VM is the most widely implemented hardening measure amongst all the banking apps analyzed. Furthermore, 78% of apps with anti-disassembly measures were resistant to FjordPhantom attacks, suggesting effectiveness even when FjordPhantom does not require static code modification.

Mitigation Strategies

Several mitigation strategies were discussed for preventing such attacks, including automated detection by Google Play Protect (GPP) and the use of Automated Hardening solutions like Promon SHIELD. GPP offers protections on both Cloud and On-Device levels, but its effectiveness may be limited if users deliberately disable it to install repackaged apps. Developers can integrate RASP solutions into the CI/CD pipeline to automatically modify APK files with protective measures against various attacks, including anti-virtualization and anti-hooking. Future work plans include a deeper investigation into the implementation details of hardening measures and RASP solutions to systematically evaluate their efficacy against accessibility abuse attacks.

Related Work Context

The research builds upon existing literature concerning virtualization-based malware, such as studies examining app-level virtualization on Android and methods like VAHunt which identify app-virtualization engines. This study contributes by focusing specifically on virtualization-related vulnerabilities in Android banking apps, and more specifically, in the region of East and Southeast Asia. It also addresses gaps by evaluating various protection measures and discussing a solution integrated into the CI/CD pipeline.

Conclusion

The study concludes that over 225 million Android users in East and Southeast Asia are subject to FjordPhantom, highlighting the need for enhanced security practices in mobile banking applications. The findings provide insights into how the banking industry can apply security concepts like hardening measures and penetration testing to bridge the gap between attacker technology and application protections.

References

[1] “Discovery of multiple new android malware targeted at southeast asia,” https://www.i-sprint.com/mobile-malware-seminar-emerging-threats-in-southeast-asia/, June 2024.

[3] “Fjordphantom,” 2025, https://attack.mitre.org/software/S1208/.

[4] “Fjordphantom malware,” 2025, https://promon.io/security-news/fjordphantom-android-malware.

[9] “Promon,” 2025, https://promon.io/security-news/fjordphantom-android-malware.

[13] S. Chen, L. Fan, G. Meng, T. Su, M. Xue, Y. Xue, Y. Liu, and L. Xu, “An empirical assessment of security risks of global android banking apps,” in 2020 IEEE/ACM 42nd International Conference on Software Engineering (ICSE), 2020.

[14] D. Dai, R. Li, J. Tang, A. Davanian, and H. Yin, “Parallel space traveling: A security analysis of app-level virtualization in android,” in Proceedings of the 25th ACM Symposium on Access Control Models and Technologies, ser. SACMAT ’20.

[17] V. K. Malviya, P. Phan, Y. Tun, A. Ching, and L. Shar, “An industrial practice for securing android apps in the banking domain,” in 2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE), Los Alamitos, CA, USA: IEEE Computer Society.

[18] A. Sharma, S. Singh, S. Kumar, A. Chhabra, and S. Gupta, Security of Android Banking Mobile Apps: Challenges and Opportunities.

[19] L. Shi, J. Ming, J. Fu, G. Peng, D. Xu, K. Gao, and X. Pan, “Vahunt: Warding off new repackaged android malware in app-virtualization’s clothing,” in Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’20.

[3] “Fjordphantom,” 2025, https://attack.mitre.org/software/S1208/.

[4] “Fjordphantom malware,” 2025, https://promon.io/security-news/fjordphantom-android-malware.

[9] “Promon,” 2025, https://promon.io/security-news/fjordphantom-android-malware.

[17] V. K. Malviya, P. Phan, Y. Tun, A. Ching, and L.

Improvements for AI systems

Improved malware detection capabilities by integrating runtime hooks into virtualization solutions to circumvent anti-tampering mechanisms, as FjordPhantom bypass[es] the detection of malicious accessibility services without tampering the app by using a virtualization solution that enables them to run the target app in a virtualized environment that they control.
Enhanced application security by proactively identifying and mitigating vulnerabilities exploited by accessibility abuse malware through automated hardening services, such as Promon SHIELD, which automatically modifies the APK file on binary level and adds protective measures into the application by injecting byte-codes related to obfuscation, tamper detection, anti-instrumentation, anti-virtualization
More robust deployment strategies for banking applications by leveraging Google Play Protect policies to restrict the invocation of virtualization frameworks and dynamic DEX/APK loading, aiming to avoid the possibility of encountering a FjordPhantomwrapped app.
Development of a comprehensive security assessment framework that combines static analysis tools like APKiD with penetration testing flows, enabling systems to assess if an APK is shielded by Runtime Application Self-Protection (RASP) solutions and then evaluate its resistance, as shown in Figure 3.
Targeted vulnerability prioritization for banking apps by correlating the distribution of hardening measures with vulnerability rates; for instance, identifying that the highest number of different hardening and protection solutions employed in an app we analyzed is five, suggesting a focus on apps with high levels of layered protection.

Abstract

Android banking applications have revolutionized financial management by allowing users to perform various financial activities through mobile devices. However, this convenience has attracted cybercriminals who exploit security vulnerabilities to access sensitive financial data. FjordPhantom, a malware identified by our industry collaborator, uses virtualization and hooking to bypass the detection of malicious accessibility services, allowing it to conduct keylogging, screen scraping, and unauthorized data access. This malware primarily affects banking and finance apps across East and Southeast Asia region where our industry partner's clients are primarily based in. It requires users to be deceived into installing a secondary malicious component and activating a malicious accessibility service. In our study, we conducted an empirical study on the susceptibility of banking apps in the region to FjordPhantom, analyzed the effectiveness of protective measures currently implemented in those apps, and discussed ways to detect and prevent such attacks by identifying and mitigating the vulnerabilities exploited by this malware.

Listen

Transcript

Key concepts

Terminology

Summary

Improvements for AI systems

Abstract

Related papers